Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Identity and Access Management/ IAM Agencies Contain Specified Policies
Updated on 2024-10-15 GMT+08:00
View PDF
Share

IAM Agencies Contain Specified Policies

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

iam-agencies-managed-policy-check

Identifier

iam-agencies-managed-policy-check

Description

If an IAM agency does not contain the specified policies and roles, this agency is noncompliant.

Tag

iam

Trigger Type

Configuration change

Filter Type

iam.agencies

Configure Rule Parameters
  • roleIdList: role IDs. System-defined roles are not supported.
  • policyIdList: policy IDs. System-defined policies are not supported.

Applicable Scenario

When you assign permissions to control resource access, the least privilege principles should be applied. This rule allows you to detect agencies that do not contain the required policies or rules, so that you can avoid granting excessive permissions with these agencies.

Solution

You can attach the required roles or policies to the noncompliant agencies. For more details, see Authorizing IAM Users to Manage Resources of an Account.

Rule Logic

  • If an IAM agency does not contain all the specified policies and roles, this agency is noncompliant.
  • If an IAM agency contains all the specified policies and roles, this agency is compliant.